Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FireEye Shares Details of Recent Cyber Attack

fireeye.com

Post reply on HN
Print view View original

191–200 of 251 posts

Re: FireEye Shares Details of Recent Cyber Attack

#191

Post by FreshFries »

supercucumber wrote: post #97
mike_d wrote: post #91

As a red teamer I want to clear up why we build "hacking tools" and why FireEye did nothing wrong here. For example take the tool mimikatz [1], which is publicly available and well known. It can dump stored passwords out of Windows memory. But if you download mimikatz and try to run it every single antivirus/endpoint protection solution will light up like a christmas tree. However, the underlying technique isn't bein…

> Matthew in accounting that will open that invoice attachment so he can pay it. This is painfully accurate. A chain is really only as strong as its weakest link :/

We (as in the IT Sec industry including me) prefer to blame Matthew. Or my 80 year old mother for not installing the latest Adobe patches in real time.

With 30 years of daily experience in this field, I am ashamed about how we fail Matthew & my mother in the sense that they can still not just enjoy the internet and open random emails without one of us blaming them for how stupid they are.

Re: FireEye Shares Details of Recent Cyber Attack

#192

Post by eoinboylan »

Ansil849 wrote: post #99
deft wrote: post #18

Will there be any public proof or evidence this is a state actor? The blog post has no details and the overuse of adjectives to describe the attacker as extremely competent sounds more like an excuse for their own weaknesses.

> The blog post has no details and the overuse of adjectives to describe the attacker as extremely competent sounds more like an excuse for their own weaknesses This was precisely my read of it as well. Exaggerated usage of superlatives coupled with no actual explanation suggests trumping up an adversary's capabilities to excuse one's own security lapses. Like claiming a highly sophisticated burglar broke into your h…

More likely the FBI telling them not to speak publicly as to not impede an investigation.

Re: FireEye Shares Details of Recent Cyber Attack

#193

Post by _kbh_ »

arafsheikh wrote: post #102
mike_d wrote: post #91

As a red teamer I want to clear up why we build "hacking tools" and why FireEye did nothing wrong here. For example take the tool mimikatz [1], which is publicly available and well known. It can dump stored passwords out of Windows memory. But if you download mimikatz and try to run it every single antivirus/endpoint protection solution will light up like a christmas tree. However, the underlying technique isn't bein…

If I understand your comment correctly - even though the fingerprints are published, the attacker can still reverse eng the implementation from the tools and bypass antivirus systems at least in the near future?

A nation-state actor likely already knows most of (if not all) of the techniques being used by FireEye. If they were really a nation-state actor then they were likely after the insight into sensitive networks rather then the tools imo.

Re: FireEye Shares Details of Recent Cyber Attack

#194

Post by [deleted] »

arafsheikh wrote: post #85

From their official blog post: > Based on my 25 years in cyber security and responding to incidents, I’ve concluded we are witnessing an attack by a nation with top-tier offensive capabilities. I wonder what nations possess “top-tier offensive capabilities” today. USA, China, Russia, Israel come to mind. Who else? Is there a list or metric to measure a nation’s cyber attack capabilities?

[deleted]

Re: FireEye Shares Details of Recent Cyber Attack

#195

Post by tester34 »

arafsheikh wrote: post #85

From their official blog post: > Based on my 25 years in cyber security and responding to incidents, I’ve concluded we are witnessing an attack by a nation with top-tier offensive capabilities. I wonder what nations possess “top-tier offensive capabilities” today. USA, China, Russia, Israel come to mind. Who else? Is there a list or metric to measure a nation’s cyber attack capabilities?

I'd say that those listed here:

https://ctftime.org/

so usa, russia, china, poland, ukraine, japan.

Re: FireEye Shares Details of Recent Cyber Attack

#196

Post by therealx »

FreshFries wrote: post #191
supercucumber wrote: post #97

Earlier quoted context omitted.

> Matthew in accounting that will open that invoice attachment so he can pay it. This is painfully accurate. A chain is really only as strong as its weakest link :/

We (as in the IT Sec industry including me) prefer to blame Matthew. Or my 80 year old mother for not installing the latest Adobe patches in real time. With 30 years of daily experience in this field, I am ashamed about how we fail Matthew & my mother in the sense that they can still not just enjoy the internet and open random emails without one of us blaming them for how stupid they are.

Do we somehow fail the dumb accountant or 80 year gma with cars because they can't just get in and drive without learning how to drive?

Re: FireEye Shares Details of Recent Cyber Attack

#197

Post by Daho0n »

1970-01-01 wrote: post #46

"They used a novel combination of techniques not witnessed by us or our partners in the past." This is the scary part. FireEye and the others have been studying and watching APTXX nation-state teams for many years. They should have some idea by now. It is entirely possible that a new team is out there.

Since FireEye worked for Equifax before it was breached one could hope they have learned a thing or two, yes.

Re: FireEye Shares Details of Recent Cyber Attack

#198

Post by vbrandl »

corty wrote: post #189
flo123456 wrote: post #183

Earlier quoted context omitted.

The invoice shouldn’t have to be a PDF and shouldn’t have to be sent via e-mail. Sadly those are still the best tools we have. It would be really cool to have an invoice format that contains payment and tax information in a machine readable way and a way to send that information around with a verifiable channel.

The invoice will be PDF with an embedded XML blob containing the machine-readable data part, signed with a PDF signature: https://www.pdf-tools.com/pdf20/en/zugferd/ pdf.js lacks capabilities to extract the XML or verify signatures, so the usual way will be to use Acrobat Reader or the usual bunch of "industry-standard" invoice-processing crap that now suddenly has to deal with malicious input. The idea to do it diff…

Having implemented rudimentary ZUGFeRD support at $dayjob a few years ago (our main product is sending, receiving and validating invoices for energy companies in Germany), I don't see ZUGFeRD becoming relevant anytime soon. At least for b2b invoices, nothing has changed since the release of ZUGFeRD. They prefer sticking to EDI formats (many with some custom edge cases for their SAP monstrosities, e.g. putting the `-` sign for negative numbers _after_ the number like `10-` for `-10`...)
Post reply on HN